Linux Kernel CVE-2026-93154

Requires local access to an Intel irdma RDMA device node with sufficient rights to use RDMA verbs (create QP/CQ/SRQ objects and register/deregister memory regions). Exploitation is performed by deregistering an MR that is still associated with a live QP/CQ/SRQ ring; the host must run an affected Linux kernel (irdma driver, roughly 5.14 up to the fixed 6.18.52/7.2.6/7.3-rc1 lines) with Intel E800/X722-class RDMA hardware or its emulation in use. Limiting factors: local-only vector (AV:L), no network reachability, and the need for a configured/usable RDMA device - hosts without irdma exposed to untrusted local users are not affected.

The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H, base 7.8) frames this as a locally-triggered, low-privilege flaw with high impact. The technical detail supports a genuine use-after-free: userspace could deregister a memory region (MR) still backing a live QP/CQ/SRQ ring because the MR carried no refcount for that association, leaving the kernel using freed/unmapped ring memory. Unlike the many RDMA error-path/probe-path siblings that are only reachable on failure unwinds, this one is directly attacker-driven through normal userspace verbs (ibv_dereg_mr), which makes it a real UAF primitive rather than a theoretical crash. That said, the C:H/I:H/A:H triad looks inflated for a bounded ring-memory UAF gated behind local RDMA-verbs access; realistic impact is dominated by crash/corruption (A:H) with only limited, non-deterministic confidentiality/integrity exposure. No EPSS score, no CISA KEV entry, and no public exploit are present in the input - no public exploit identified at time of analysis. Net: a legitimate local privilege/DoS concern for hosts exposing Intel irdma to untrusted local users, but not a widespread-exploitation priority. Realistic severity is closer to ~5.5-6.5 than 7.8.

A local user with access to the Intel irdma RDMA device creates a QP/CQ/SRQ, registers a memory region to back its ring, then deregisters that MR while the ring is still active. The kernel continues to use the now-freed ring memory, yielding a use-after-free that can crash the host or be groomed toward memory corruption and local privilege escalation. No public exploit is identified at time of analysis.